# Mixed content

> Mixed content means resources, such as images or scripts, that an HTTPS page loads over unencrypted HTTP. Browsers block or flag them.

- **Check ID:** SEC8
- **Area:** [Security](https://be1st.ai/glossary/security)
- **Tool:** [SEO + Security + Performance](https://be1st.ai/tools/ssp-audit)
- **Page:** https://be1st.ai/glossary/security/mixed-content

## Why it matters

Even if the main page is on HTTPS, HTTP resources can be intercepted and modified by an attacker on the network. A malicious script loaded over HTTP on an HTTPS page has full access to the DOM and cookies. Browsers block active mixed content (scripts, iframes) and flag passive content (images) with a warning.

## In practice

An e-shop on HTTPS loads product images from http://cdn.example.com/product.jpg. Chrome displays a 'Mixed Content' warning in the console and the padlock icon disappears. After changing to https://cdn.example.com/product.jpg, the page is fully secured and the padlock returns.

## How be1st checks it

Checks whether an HTTPS page contains resources loaded over the unencrypted HTTP protocol (images, scripts, styles, fonts). Such content is called 'mixed content' and compromises the security of the entire page.

[SEO + Security + Performance](https://be1st.ai/tools/ssp-audit), Security tab.

Every check ends as: Pass, Warning, Fail.

## Sources

- [Mixed content](https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Mixed_content) (MDN)
- [Content Security Policy guide](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP) (MDN)

## Related terms

- [HTTPS (security)](https://be1st.ai/glossary/security/https): HTTPS is HTTP encrypted with TLS. It keeps passwords, forms and cookies private on the way between the visitor and the server.
- [Security warnings](https://be1st.ai/glossary/security/security-warnings): Security warnings are messages the browser writes to its console when it finds a security problem on a page, such as a blocked resource or an invalid policy.
- [Insecure cookies](https://be1st.ai/glossary/security/insecure-cookies): An insecure cookie is a cookie set without the Secure, HttpOnly or SameSite attribute, which leaves it open to theft or misuse by other sites.
- [Deprecated APIs](https://be1st.ai/glossary/security/deprecated-apis): Deprecated APIs are browser features that are being phased out. Code that still uses them can stop working once browsers remove them.
- [Strict-Transport-Security (HSTS)](https://be1st.ai/glossary/security/strict-transport-security-hsts): Strict-Transport-Security (HSTS) is an HTTP header that tells browsers to use a website only over HTTPS for a set time, even when someone types or links http://.
- [Content-Security-Policy (CSP)](https://be1st.ai/glossary/security/content-security-policy-csp): Content-Security-Policy (CSP) is an HTTP header that lists the sources a page may load scripts, styles, images and frames from. It is the main defence against XSS.